CVE-2024-14006

Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-supplied HTTP Host header when constructing absolute URLs without sufficient validation. An unauthenticated, remote attacker can supply a crafted Host header to poison generated links or responses, which may facilitate phishing of credentials, account recovery link hijacking, and web cache poisoning.

• CWE-346

• https://www.nagios.com/changelog/nagios-xi/Release Notes
• https://www.nagios.com/products/security/#nagios-xiVendor Advisory
• https://www.vulncheck.com/advisories/nagios-xi-host-header-injectionThird Party Advisory

Published

Oct 30, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-14000Nagios XI versions prior to 2024R1.1.3 are vulnerable to cro…5.4
• CVE-2024-14001Nagios XI versions prior to 2024R1.1.3 are vulnerable to cro…5.4
• CVE-2024-14002Nagios XI versions prior to 2024R1.1.4 contain a local file …5.5
• CVE-2024-14003Nagios XI versions prior to 2024R1.2 are vulnerable to remot…9.8
• CVE-2024-14004Nagios XI versions prior to 2024R1.2 contain a privilege esc…8.8
• CVE-2024-14005Nagios XI versions prior to 2024R1.2 contain a command injec…8.8
• CVE-2024-14007Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware…8.7
• CVE-2024-14008Nagios XI versions prior to 2024R1.3.2 contain a remote comm…7.2
• CVE-2024-14009Nagios XI versions prior to 2024R1.0.1 contain a privilege e…7.2
• CVE-2024-1401The Profile Box Shortcode And Widget WordPress plugin before…4.8
• CVE-2024-14010Typora 1.7.4 contains a command injection vulnerability in t…9.8
• CVE-2024-14011Rejected reason: This is a duplicate.